fix: 绑定集成测试并收紧审批接口鉴权

src/main/java/com/gxwebsoft/common/core/config/MybatisPlusConfig.java

@@ -61,6 +61,7 @@ public class MybatisPlusConfig {
           }
         }
 //        return getLoginUserTenantId();
+        // 兜底租户：仅供未携带 TenantId/Domain 头的内部调用；审批请求必须由客户端显式携带租户头。
         return new LongValue(10150);
       }
 

src/main/java/com/gxwebsoft/common/core/security/SecurityConfig.java

@@ -35,6 +35,9 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
         http.authorizeRequests()
                 .antMatchers(HttpMethod.OPTIONS, "/**")
                 .permitAll()
+                // 审批接口必须登录；方法级 @PreAuthorize 再校验具体权限
+                .antMatchers("/api/approval/**")
+                .authenticated()
                 .antMatchers(HttpMethod.GET, "/api/file/**","/**", "/api/captcha", "/")
                 .permitAll()
                 .antMatchers(